privacy-and-ai-control-applicability
Use this when a privacy or AI extension is added to an existing security management system, and again when a new product, processing activity or AI system enters scope. You get two files in a new folder, ./privacy-and-ai-control-applicability/: a spreadsheet you can open in Excel listing each extra privacy or AI control, whether it applies and why, in the same layout as your existing applicability statement (soa-extension.csv), and notes recording the company's role for each processing activity and AI system, with open questions (role-and-scope-notes.md). This skill drafts for a human to review and sign; this skill never marks a control effective. Role decisions with legal effect are confirmed by the company's privacy or legal owner.
Inputs to gather
For privacy: the records of processing, data processing agreements (both directions), the privacy notice, the subprocessor list and impact assessments. For AI: the AI system inventory, product documentation, model and vendor contracts, and AI impact or risk assessments. For both: the existing statement of applicability, the risk register and the scope statement. Load the additional control identifiers from the reader's licensed copy of the extension standard or their compliance platform; if neither is available, stop and ask. Ask the reader which extension is in scope and who confirms role decisions.
Step 1: settle roles, activity by activity
Privacy. For each processing activity, decide whether the company determines why and how the data is processed (controller), processes it only on a customer's instructions (processor), decides jointly with a partner (joint controller, which needs a GDPR Article 26 arrangement), or holds different roles across different activities. Base each decision on the contract and on what actually happens, not the preferred label. Patterns to check: every employer is a controller for staff data; marketing lists, product analytics and support tooling are usually controller activities even for a company that sells a processor service; using customer data to improve the product moves that use towards controller.
AI. For each AI system, record what the company does with it: develops or trains a model, builds a system on a third-party model (prompts, retrieval, tools, fine-tuning), supplies AI components to others, or uses an AI tool internally. One company often holds several roles across systems. Building a product feature on a hosted model is more than use. Where the EU AI Act may apply, record the likely provider or deployer classification per system as a flag for the legal owner, not a determination.
Write the role table in the notes (role-and-scope-notes.md) with the source for each decision.
Step 2: map roles to candidate controls
Which additional controls are candidates depends on the roles from step 1. Run a framework lookup or read the licensed text to find which controls attach to each privacy role and to each kind of AI activity; never assume that link from memory. A control is a candidate whenever at least one in-scope activity or system holds a matching role.